[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Mon Sep 28 20:13:52 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4e4fa81a by security tracker role at 2026-09-28T19:13:44+00:00
automatic NOT-FOR-US entries update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
 CVE-2026-97686 (Wind River VxWorks 7 prior to 26.09, specific system call arguments ca ...)
-	TODO: check
+	NOT-FOR-US: WindRiver
 CVE-2026-97399 (The strncasecmp function in the GNU C Library 2.24 and later optimized ...)
 	TODO: check
 CVE-2026-97335 (Incorrect authorization in the custom storage volume creation endpoint ...)
@@ -35,9 +35,9 @@ CVE-2026-93348 (Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented i
 CVE-2026-92103 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
 	TODO: check
 CVE-2026-91206 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-91204 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-91154 (Missing Authentication for Critical Function (CWE-306) in the product  ...)
 	TODO: check
 CVE-2026-91043 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
@@ -55,7 +55,7 @@ CVE-2026-88805 (Incorrect credential cleaning on logout could be used by remote
 CVE-2026-88804 (An unauthenticated update of public UI settings could be used by remot ...)
 	TODO: check
 CVE-2026-87969 (An OS command injection vulnerability in the WatchGuard AP diagnostic  ...)
-	TODO: check
+	NOT-FOR-US: WatchGuard
 CVE-2026-87799 (Improper link resolution in the migration receive path in Canonical LX ...)
 	TODO: check
 CVE-2026-87798 (Improper link resolution in the recursive file pull feature of the LXD ...)
@@ -69,7 +69,7 @@ CVE-2026-86595 (Improper neutralization of special elements used in an SQL comma
 CVE-2026-86530 (BUFFALO Wi-Fi products handle some web form input improperly to assemb ...)
 	TODO: check
 CVE-2026-86507 (Improper neutralization of input in Apache Roller 6.1.5 allows an anon ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-86335 (Missing Authorization in imageDownload in Canonical LXD before 5.0.10, ...)
 	TODO: check
 CVE-2026-86334 (Path traversal in the CLI client image export and copy functionality i ...)
@@ -77,7 +77,7 @@ CVE-2026-86334 (Path traversal in the CLI client image export and copy functiona
 CVE-2026-86330 (An OS command injection flaw was found in the set_hostname_internal fu ...)
 	TODO: check
 CVE-2026-86102 (An OS command injection vulnerability in the WatchGuard AP internal AP ...)
-	TODO: check
+	NOT-FOR-US: WatchGuard
 CVE-2026-85526 (Path traversal in the Btrfs storage driver (unpackVolume) in Canonical ...)
 	TODO: check
 CVE-2026-85185 (Path traversal in the btrfs storage driver in Canonical LXD versions 4 ...)
@@ -105,35 +105,35 @@ CVE-2026-82928 (mH-DEVELOPER smart home module contains a hardcoded SSH public k
 CVE-2026-82915 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
 	TODO: check
 CVE-2026-82546 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82387 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82386 (Improper Restriction of XML External Entity Reference in Apache Roller ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82385 (Exposure of Sensitive Information to an Unauthorized Actor in Apache R ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82384 (Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an una ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82383 (Missing Authentication for Critical Function in Apache Roller 6.1.5 al ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82382 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82381 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82380 (Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remo ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82379 (Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows  ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82378 (Incorrect Authorization in the OAuth 1.0a authorization endpoint of Ap ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82377 (Missing Authorization in Apache Roller 6.1.5 allows an authenticated u ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82376 (Improper Restriction of XML External Entity Reference in Apache Roller ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82375 (Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an au ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82348 (Authorization Bypass Through User-Controlled Key in Apache Roller 6.1. ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82326 (Improper neutralization of input during web page generation ('cross-si ...)
 	TODO: check
 CVE-2026-82323 (Authorization bypass through User-Controlled key vulnerability in Enoc ...)
@@ -143,11 +143,11 @@ CVE-2026-81867 (A Deserialization of Untrusted Data vulnerability in the JavaScr
 CVE-2026-81375 (A Confused Deputy vulnerability in the EmailTask component in Google C ...)
 	TODO: check
 CVE-2026-80359 (Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.20 ...)
-	TODO: check
+	NOT-FOR-US: Dell / EMC
 CVE-2026-80358 (Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.20 ...)
-	TODO: check
+	NOT-FOR-US: Dell / EMC
 CVE-2026-80357 (Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.20 ...)
-	TODO: check
+	NOT-FOR-US: Dell / EMC
 CVE-2026-7172 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the followi ...)
 	TODO: check
 CVE-2026-7171 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the followi ...)
@@ -165,9 +165,9 @@ CVE-2026-73641 (Dayforce Payroll is vulnerable to Reflected XSS in multiple endp
 CVE-2026-73640 (Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in pa ...)
 	TODO: check
 CVE-2026-70413 (Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s)  ...)
-	TODO: check
+	NOT-FOR-US: Dell / EMC
 CVE-2026-59563 (Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC co ...)
-	TODO: check
+	NOT-FOR-US: Zscaler
 CVE-2026-58464
 	REJECTED
 CVE-2026-58463
@@ -209,23 +209,23 @@ CVE-2026-19444 (A path traversal vulnerability was discovered in the Kubernetesk
 CVE-2026-18825 (An Origin Validation Error in the middleware of the connect-xcors npm  ...)
 	TODO: check
 CVE-2026-15953 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
-	TODO: check
+	NOT-FOR-US: ABB group
 CVE-2026-15952 (Incorrect Permission Assignment for Critical Resource vulnerability in ...)
-	TODO: check
+	NOT-FOR-US: ABB group
 CVE-2026-13018 (Insufficient validation of untrusted input in Codecs in Google Chrome  ...)
 	TODO: check
 CVE-2026-12342 (This vulnerability impacts all versions of IdentityIQ and allows an un ...)
 	TODO: check
 CVE-2026-12269 (Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepali ...)
-	TODO: check
+	NOT-FOR-US: Zoho
 CVE-2026-12268 (ManageEngine DDI Central versions below 6201 are vulnerable toPowerShe ...)
-	TODO: check
+	NOT-FOR-US: Zoho
 CVE-2026-12267 (ManageEngine DDI Central versions below 6201 are vulnerable toCommand  ...)
-	TODO: check
+	NOT-FOR-US: Zoho
 CVE-2026-12265 (Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable  ...)
-	TODO: check
+	NOT-FOR-US: Zoho
 CVE-2026-12264 (Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable  ...)
-	TODO: check
+	NOT-FOR-US: Zoho
 CVE-2026-102010 (A flaw was found in GCC. When an application calls the erase_if functi ...)
 	TODO: check
 CVE-2026-101913 (ip-address is a library for parsing and manipulating IPv4 and IPv6 add ...)
@@ -261,7 +261,7 @@ CVE-2026-101898 (Axios is a promise-based HTTP client for the browser and Node.j
 CVE-2026-101894 (The decompress package for Node.js extracts archives. Prior to 10.2.2  ...)
 	TODO: check
 CVE-2026-101891 (An improper access control vulnerability in an internal API service on ...)
-	TODO: check
+	NOT-FOR-US: WatchGuard
 CVE-2026-101861 (Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsa ...)
 	TODO: check
 CVE-2026-101333 (A flaw was found in the Micrometer user-event metrics listener of Keyc ...)
@@ -273,15 +273,15 @@ CVE-2026-101132 (A security flaw has been discovered in DeepSeek deepseek-harnes
 CVE-2026-101131 (A vulnerability was identified in deepseek-ai deepseek-harness up to 0 ...)
 	TODO: check
 CVE-2026-101111 (Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Bo ...)
-	TODO: check
+	NOT-FOR-US: Joomla
 CVE-2026-101110 (Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Boo ...)
-	TODO: check
+	NOT-FOR-US: Joomla
 CVE-2026-101109 (Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Ve ...)
-	TODO: check
+	NOT-FOR-US: Joomla
 CVE-2026-101108 (Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Veh ...)
-	TODO: check
+	NOT-FOR-US: Joomla
 CVE-2026-101105 (A vulnerability was determined in code-projects Matrimonial System 1.0 ...)
-	TODO: check
+	NOT-FOR-US: code-projects
 CVE-2026-101102 (A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0- ...)
 	TODO: check
 CVE-2026-101101 (A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-0 ...)
@@ -297,7 +297,7 @@ CVE-2026-101083 (A security vulnerability has been detected in PMWeb v7.x/v8.x/v
 CVE-2026-101082 (A weakness has been identified in PMWeb 7.x/8.x/2025.x. This issue aff ...)
 	TODO: check
 CVE-2026-101081 (A security flaw has been discovered in D-Link DI-8400 16.07. This vuln ...)
-	TODO: check
+	NOT-FOR-US: D-Link
 CVE-2026-101080 (A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4 ...)
 	TODO: check
 CVE-2026-101079 (A vulnerability was found in agentverus agentverus-scanner up to 0.8.1 ...)
@@ -371,13 +371,13 @@ CVE-2026-101009 (A vulnerability was determined in aaPanel BaoTa up to 11.8.0. T
 CVE-2026-101008 (A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is t ...)
 	TODO: check
 CVE-2026-100753 (Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Re ...)
-	TODO: check
+	NOT-FOR-US: Joomla
 CVE-2026-100752 (Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Rea ...)
-	TODO: check
+	NOT-FOR-US: Joomla
 CVE-2026-100751 (Joomla Extension - regularlabs.com - Privileged stored XSS via data-rl ...)
-	TODO: check
+	NOT-FOR-US: Joomla
 CVE-2026-100750 (Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1. ...)
-	TODO: check
+	NOT-FOR-US: Joomla
 CVE-2026-85644 (XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a numb ...)
 	- libxs-parse-keyword-perl <unfixed> (bug #1149243)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/43916020/



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e4fa81a8aa43d63ad143f837229ae7b99a388de

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e4fa81a8aa43d63ad143f837229ae7b99a388de
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260928/62d3d110/attachment.htm>

More information about the debian-security-tracker-commits mailing list